{"id":"CVE-2012-5864","aliases":["EUVD-2012-5742","GHSA-v26h-2hg9-6mq7"],"status":"published","title":"Sinapsi eSolar Improper Authentication","description":"These Sinapsi devices \ndo not check if users that visit pages within the device have properly \nauthenticated. By directly visiting the pages within the device, \nattackers can gain unauthorized access with administrative privileges.","severity":{"version":"2.0","score":9.4,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:N","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.04905,"percentile":0.92151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-264","CWE-287"],"published":"2012-11-23T11:00:00Z","modified":"2026-06-16T23:47:29Z","exploits":[{"source":"exploitdb","id":"EDB-21273","title":"Ezylog Photovoltaic Management Server - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2012-09-12","url":"https://www.exploit-db.com/exploits/21273"}],"products":[{"vendor":"sinapsi","product":"esolar"},{"vendor":"sinapsi","product":"esolar duo"},{"vendor":"sinapsi","product":"esolar light"},{"vendor":"sinapsitech","product":"esolar_duo_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"esolar_light_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"esolar_photovoltaic_system_monitor"},{"vendor":"sinapsitech","product":"sinapsi_firmware"}],"references":[{"url":"http://www.exploit-db.com/exploits/21273/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2012-09/0045.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80200","tags":["vdb-entry","x_refsource_XF"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-12-325-01"},{"url":"http://www.sinapsitech.it/default.asp?active_page_id=78\u0026news_id=88","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/80203","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.us-cert.gov/control_systems/pdf/ICSA-12-325-01.pdf","tags":["x_refsource_MISC","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5864"},{"url":"http://www.exploit-db.com/exploits/21273"},{"url":"https://github.com/advisories/GHSA-v26h-2hg9-6mq7"}],"sources":{"cve":[{"id":"CVE-2012-5864","title":"Sinapsi eSolar Improper Authentication","description":"These Sinapsi devices \ndo not check if users that visit pages within the device have properly \nauthenticated. By directly visiting the pages within the device, \nattackers can gain unauthorized access with administrative privileges.","status":"published","published":"2012-11-23T11:00:00Z","modified":"2025-07-08T15:27:10.014Z","cvss":[{"version":"2.0","score":9.4,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:N","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2012-5742","description":"These Sinapsi devices \ndo not check if users that visit pages within the device have properly \nauthenticated. By directly visiting the pages within the device, \nattackers can gain unauthorized access with administrative privileges.","status":"published","published":"2012-11-23T11:00:00Z","modified":"2025-07-08T15:27:10Z","cvss":[{"version":"2.0","score":9.4,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:N","level":"critical"}],"updated_at":"2026-11-02T20:32:12.59227Z"}],"ghsa":[{"id":"GHSA-v26h-2hg9-6mq7","title":"The management web pages on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider...","description":"The management web pages on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 do not require authentication, which allows remote attackers to obtain administrative access via a direct request, as demonstrated by a request to ping.php.","status":"published","published":"2022-05-17T01:38:30Z","modified":"2025-07-08T18:31:34Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:02:56.619633Z"}],"nvd":[{"id":"CVE-2012-5864","description":"These Sinapsi devices \ndo not check if users that visit pages within the device have properly \nauthenticated. By directly visiting the pages within the device, \nattackers can gain unauthorized access with administrative privileges.","status":"published","published":"2012-11-23T12:09:58.54Z","modified":"2026-06-16T23:47:29.037Z","cvss":[{"version":"2.0","score":9.4,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-287","CWE-264"],"updated_at":"2026-11-02T14:02:16.536025Z"}]}}